Skip to content
Connect AISign inSign up free

Bug bounty program

AC

Acronis

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
21
Disclosed reports
128
Subdomains
2,285
Vendor on CyberSIXT
Acronis (232 CVEs, 2 exploited)

Most upvoted reports128

All reports
Most upvoted reports of Acronis
ReportWeaknessDisclosedBountyVotes
SQL Injection in agent-managerAnalysed#962889SQL Injection2021-08-16–237
bypass sql injection #1109311Analysed#1224660SQL Injection2021-10-05–164
IDOR vulnerability (Price manipulation)Analysed#1403176Insecure Direct Object Reference2021-11-30–146
Ticket Trick at https://account.acronis.comAnalysed#999765Access Control2020-11-10–142
[oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943Cross-site Scripting2024-12-28$100134
IP restriction bypass via X-Forwarded-For headerAnalysed#1224089Access Control2024-12-05$250126
Stored XSS in backup scanning plan nameAnalysed#961046Cross-site Scripting2021-06-28$500120
SQL injection on admin.acronis.host development web serviceAnalysed#923020SQL Injection2021-06-22$250118
Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Analysed#1124974Access Control2022-02-08–109
Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062No weakness recorded2024-11-28–106

Subdomains2,285

Root:devicelock.com
Scope
Name suggests
First seen
Text fileClear filters61 names
Subdomains of Acronis
NameScopeFirst seen
adserv.devicelock.comIn scope2026-11-14
affiliation.devicelock.comIn scope2026-11-14
cake.devicelock.comIn scope2026-11-14
design.devicelock.comIn scope2026-11-14
m.design.devicelock.comIn scope2026-11-14
dlpt.devicelock.comIn scope2026-11-14
download.devicelock.comIn scope2026-11-14
ftp.devicelock.comdataIn scope2026-11-14
ru.ftp.devicelock.comdataIn scope2026-11-14
home1.devicelock.comIn scope2026-11-14
home2.devicelock.comIn scope2026-11-14
hq.devicelock.comIn scope2026-11-14
https.devicelock.comIn scope2026-11-14
lander.devicelock.comIn scope2026-11-14
licserv.devicelock.comIn scope2026-11-14
m.devicelock.comIn scope2026-11-14
mail.devicelock.commailIn scope2026-11-14
mx1.devicelock.comIn scope2026-11-14
mx2.devicelock.comIn scope2026-11-14
mx3.devicelock.comIn scope2026-11-14
myapps.devicelock.comIn scope2026-11-14
myweb.devicelock.comIn scope2026-11-14
na.devicelock.comIn scope2026-11-14
noleaks.devicelock.comIn scope2026-11-14
office.devicelock.comIn scope2026-11-14
ext.office.devicelock.comIn scope2026-11-14
mail.office.devicelock.commailIn scope2026-11-14
mx.office.devicelock.commailIn scope2026-11-14
school.devicelock.comIn scope2026-11-14
search1.devicelock.comIn scope2026-11-14
xenapp.showroom.devicelock.comIn scope2026-11-14
vpn.devicelock.comvpnIn scope2026-11-14
wall.devicelock.comIn scope2026-11-14
wan.devicelock.comIn scope2026-11-14
warren.devicelock.comIn scope2026-11-14
watch.devicelock.comIn scope2026-11-14
wb.devicelock.comIn scope2026-11-14
webapp.devicelock.comIn scope2026-11-14
webapps2.devicelock.comIn scope2026-11-14
webcal.devicelock.comIn scope2026-11-14
webcast.devicelock.comIn scope2026-11-14
webchat.devicelock.comIn scope2026-11-14
webex.devicelock.comIn scope2026-11-14
webhost1.devicelock.comIn scope2026-11-14
webmail02.devicelock.commailIn scope2026-11-14
werbung.devicelock.comIn scope2026-11-14
who.devicelock.comIn scope2026-11-14
wikis.devicelock.comIn scope2026-11-14
win14.devicelock.comIn scope2026-11-14
win19.devicelock.comIn scope2026-11-14
win20.devicelock.comIn scope2026-11-14
win6.devicelock.comIn scope2026-11-14
wip.devicelock.comIn scope2026-11-14
wolf.devicelock.comIn scope2026-11-14
ww4.devicelock.comIn scope2026-11-14
www.devicelock.comIn scope2026-11-14
www-new.devicelock.comIn scope2026-11-14
www-origin.devicelock.comIn scope2026-11-14
www-staging.devicelock.comstagingIn scope2026-11-14
wwwww.devicelock.comIn scope2026-11-14
wyx.devicelock.comIn scope2026-11-14

2,283 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated